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Reference to Related Documents 

[0001] This application claims priority to, and the benefit of, U.S. Provisional Patent 

Application Serial No. 60/272,487, entitled "Online Card Activation" filed on February 27, 
2001, the entire contents of which are hereby incorporated by reference. 



Field of Invention 

The present invention relates to activating a card or device (such as, for example, a 
credit card, a debit card or a cellular phone) through a computer network, and more 
particularly, through a site on a global computer network such as, for example, the Internet. 

::J Background of the Invention 

[(W03] In today's changing economy, people often use transaction cards such as credit 

U cards or debit cards for numerous reasons. For example, transaction cards are lightweight 

and easier to carry than cash or a checkbook. Further, the need for a cardholder or 
consumer to carry a large amount of cash or other negotiable instruments when shopping is 
minimized. Cardholders also enjoy the convenience of the card's purchasing power when 
an unexpected expense or shopping opportunity arises. While the use of such cards has 
grown tremendously, the problems associated with card fraud or the use of stolen cards has 
also grown. As such, card providers often explore various methods or technologies to 
minimize card fraud or theft of the card. 

[0004] The card activation process was instituted by card issuers or providers to protect 

themselves and the cardholder from improper use of the card before it was actually in the 
possession of the cardholder (i.e., through fraud or theft of the card). Card activation is 
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typically the process for cardholders to communicate to the issuer that the cardholder has 
received the plastic representing their account from the issuer, and that the account is now 
ready to be activated so it can be used by the cardholder. Until the card is activated, it 
usually cannot be used for any purchases. 

Typical card activation systems are provided by voice response or manual customer 
service systems, such as, for example, the voice response systems disclosed in U.S. Patent 
Nos. 5,351,285, 5,297,197, 5,259,023, 5,251,252, 5,128,984, 5,109,404 and 5,014,298 the 
entire contents of which are hereby incorporated by reference as background. Both 
technologies are disadvantageous because, for example, voice response systems often limit 
the fraud identification capabilities, while manual systems usually increase cost and are not 
overly convenient for the customer (since the customer is typically dependent on the 
issuer's employee being available). Moreover, most card activation systems currently have 
one form and/or function. This applies not only to the system itself, but also to the different 
channels that are offered by card issuers to activate a card. For instance, a customer can use 
a voice response system to activate their card, but if any problems are encountered while 
using the voice response system, the cardholder is directed to a customer service 
representative. 

Summary of the Invention 

An exemplary embodiment of the present invention includes a new online card 
activation site that will allow any consumer or cardholder with network access (e.g., 
Internet, WAN, LAN, etc) to activate their card or other account associated with a new 
account, renewal or replacement. More specifically, the present invention relates to a 
method for online card activation between a cardholder or consumer interacting with at 
least a first computing system and a second computing system in communication with the 
first computing system over a first network. The method includes, in one embodiment, 
providing a notice to a consumer to activate a card (for example, a new card, a renewal card 
or a replacement card) on a site on a first computing system, instructing the consumer to 
access the site, prompting the consumer to provide predetermined card information to the 
site and communicating the predetermined card information to the second computing 
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system over the first network, thereby allowing the at least second computing system to 
process the predetermined card information against previously stored account data and 
notifying the consumer on the first computing network of the activation processing results. 

Brief Description of the Drawings 

Additional aspects of the present invention will become evident upon reviewing the 
non-limiting embodiments described in the specification and the claims taken in 
conjunction with the accompanying figures, wherein like reference numerals denote like 
elements. 

FIG. 1 is a representative block diagram of a computing system as configured for 
one embodiment of the present invention; 

FIG. 2 is an exemplary block flow diagram of one activation embodiment process of 
the present invention; 

FIG. 3 is an exemplary block flow diagram of the fraud process of the present 
invention; 

FIG. 3 a is the continuing exemplary block flow diagram of the fraud process 
illustrated in Fig. 3; and 

FIG 4 is an exemplary block flow diagram of the error messaging process of the 
present invention. 

Detailed Description 

Systems and methods in accordance with various aspects of the present invention 
provide an online or interactive card activation process between a cardholder and a card 
provider. As used herein, the terms "cardmember", "card issuer", "provider", "purchaser", 
"customer", "consumer", and "end-user" may be used interchangeably with each other, and 
each shall mean any person, entity, business, machine, hardware, or software which 
participates in the present system for on-line activation. 

As seen generally in Figure 1, the present invention is a system and method for 
online card activation between a cardholder or consumer interacting with a first computing 
system 101, a second computing system 201 in communication with the first computing 
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system 101 over a first network Ni (such as, for example, a data network, a local area 
network (LAN), a wide area network (WAN), a global computer network such as the 
Internet, a cardholder-accessible network or other network architectures) and optionally, a 
third computing system 301 in communication with the second computing system 201 over 
at least a second network N x (such as, for example, a payment network, LAN, WAN, the 
Internet or like known network architectures). The system may include a host server 
including a processor for processing digital data, a memory coupled to said processor for 
storing digital data, an input digitizer coupled to the processor for inputting digital data, an 
application program stored in said memory and accessible by said processor for directing 
processing of digital data by said processor, a display coupled to the processor and memory 
for displaying information derived from digital data processed by said processor and a 
plurality of databases, said databases including client data, account data, card data, 
merchant data, financial institution data and/or like data that could be used in association 
with the present invention. 

The first computing system 101, in one embodiment, is a personal computer, laptop 
computer or like primary personal computing means. Also, in one embodiment, the first 
network Ni is a network configured to transmit data or signals over the first network Ni by 
conventional communication transmission means such as by wire, wireless, satellite, radio 
frequency, cable, DSL, fiber optic cables or any combination of these or other 
communication means. Those of skill in the art will realize that any data or signals 
traveling over the communication means are formed from any number of conventional 
techniques, including binary signals, analog signals, high-level software code or low-level 
software code, whether or not in encrypted format. 

The second computing system 201 is, in one embodiment, a computer server, 
computer mainframe or like secondary computing means optimally configured to store, 
process and transmit data over any of the networks Ni or N x . The third computing system - 
301 is, in one embodiment, a computer server, computer main frame or other alternative 
computing means optimally configured to store, process and transmit large amounts of data 
over the network N x such as a payment network. 

A "card" or "account number", as used herein, includes any device, code, or other 
identifier suitably configured to allow the consumer to interact or communicate with the 
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system, such as, for example, a rewards card, loyalty card, charge card, credit card, debit 
card, prepaid card, telephone card, smart card, magnetic stripe card, bar code card, stored- 
value card, financial transaction card, financial instrument, cellular phone, transponder 
device and/or like physical device which allows a customer or consumer to access their 
account with the provider, authorization/access code, personal identification number (PIN), 
Internet code, other identification code, and/or the like. Additionally, a "card" may 
comprise any form of plastic, electronic, magnetic, and/or optical device which is capable 
of representing a cardmember account. Similarly, in an alternate embodiment, the present 
invention also encompasses a computer based network service (including any type of 
Internet web service or electronic mail account, for example) and/or like software-based 
algorithm which allows a consumer to access their account with the provider, 
authorization/access code, personal identification number (PIN), Internet code, other 
identification code, and/or the like. A customer account number may be, for example, a 
sixteen-digit credit card number, although each credit provider may have its own 
numbering system, such as the fifteen-digit numbering system used by American Express. 
Each company's credit card numbers comply with that company's standardized format such 
that the company using a sixteen-digit format will generally use four spaced sets of 
numbers, as represented by, for example, the number "0000 0000 0000 0000". The first 
five to seven digits are, for example, reserved for processing purposes and identify the 
issuing bank, card type, etc. In this example, the last sixteenth digit is used as a sum check 
for the sixteen-digit number. The intermediary eight-to-ten digits are used to uniquely 
identify the customer. Those of skill in the art will realize that other card information may 
also be available corresponding either to the cardholder or the card, either by placing such 
information on the card by known means or by storage of such information in a database. 

It should be understood that the exemplary process or steps illustrated may include 
more or less steps or may be performed in the context of a larger processing scheme. 
Furthermore, the various flowcharts presented in the drawing figures are not to be construed 
as limiting the order in which the individual process steps may be performed. 

In accordance with one exemplary embodiment of a method of the present 
invention, as seen in Fig. 2, a notice is provided to a cardholder (step 1 1) by, for example, a 
card issuer or provider (such as Bank of America, Bank One or other organizations who 
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issue such cards as American Express, Visa, Discover or like cards). The notice can relate 
to, for example, a non-activated card notice associated with a new card account, a renewal 
card or a replacement card. The card corresponds to a cardholder account or like card 
information, and contains, for example, the account number, the cardholder's name, card 
identification number and like card information imprinted on the card. 

The cardholder is provided with various methods to activate the card (including by 
conventional methods such as a voice response system), but the present method allows the 
cardholder to access a site on a computer network, and more specifically, the cardholder is 
instructed to access the provider's specified web site on a global computer network such as 
the Internet N x (step 13). The cardholder then operates the first computing system 101 to 
communicate with or otherwise access a site (such as, for example, a web site) on the 
second computing system 201 via network Ni such as the Internet (step 13). 

When the cardholder accesses this site, the cardholder user is prompted to provide 
predetermined card information to the site, such as, for example, the cardholder's name, 
any predetermined identifiers printed on the card (such as alphanumeric text), the 
cardholder's account number with the provider (step 15) or like predetermined card 
information. Thus, for example, the cardholder may enter their name, account number, and 
card identification number (CID) as it appears on the card or account being activated. In an 
exemplary embodiment, the card information requested may be dynamically identified, in 
support of various authentication requirements of various products or services and different 
geographical locales, nations or treaties in effect. After the cardholder submits this 
information to the site, the predetermined card information is communicated to the second 
computing system 201 over network Ni. The second computing system 201 processes or 
compares the predetermined card information against previously stored customer data (step 
17). Thus, in one exemplary embodiment, the card information is processed by comparing 
previously-stored database information corresponding to either the cardholder or the card 
with the entered predetermined card information. Alternatively, the second computing 
system 201 can process the information by also communicating with the third computing 
system 301 via the network N x to obtain any additional database information stored on the 
third computing system 301 corresponding to the cardholder or the card. The information 
stored on third computing system 301 may correspond to additional authorization and 
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billing systems and databases. Those of skill in the art will appreciate that the second 
computing system 201 can also communicate with other like computing systems in 
communication with the network N x to obtain the same or similar information. 

The second computing system 201 next determines whether the cardholder-supplied 
card information matches the previously stored customer data (step 19) in a database. 
Database may be any type of database, such as a relational, hierarchical, object-oriented, 
and/or like database. Common database products that may be used to implement database 
103 include DB2 by IBM (of White Plains, NY), any of the database products available 
from Oracle Corporation (of Redwood Shores, CA), Microsoft Access by Microsoft 
Corporation (of Redmond, Washington), or any other database product. The database may 
be organized in any suitable manner, including as data tables or lookup tables. Association 
of certain data may be accomplished through any data association technique known and 
practiced in the art. For example, the association may be accomplished either manually or 
automatically. Automatic association techniques may include, for example, a database 
search, a database merge, GREP, AGREP, SQL, and/or the like. The association step may 
be accomplished by a database merge function, for example, using a "key field" in each of 
the manufacturer and retailer data tables. A "key field" partitions the database according to 
the class of objects defined by the key field. For example, a certain class may be 
designated as a key field in both the first data table and the second data table, and the two 
data tables may then be merged on the basis of the class data in the key field. In this 
embodiment, the data corresponding to the key field in each of the merged data tables is in 
one embodiment the same. However, data tables having similar, though not identical, data 
in the key fields may also be merged by using AGREP, for example. 

If the card information does not match the system data as illustrated in Fig. 2, step 
19, the second computing system 201 then transmits an online card activation decline 
message to the cardholder for display on first computing system 101 via network Ni. The 
online card activation decline message may be of any suitable text, but in one embodiment, 
will notify the cardholder that the card cannot be activated online for any predetermined 
reason, including, for example, "We cannot process your request at this time. Please call 
our 1-800 number for further assistance." 
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If the card information does match the system data as illustrated in Fig. 2, step 19, 
the second computing system 201 next determines whether the card is unavailable for 
processing, for example by determining whether the card has already been activated and/or 
authorized for use (step 21). If the card was previously activated or authorized for use by 
the provider, the second computing system 201 then displays a card already activated 
message to the cardholder on first computing system 101 via network Ni. The card already 
activated message may be of any suitable text such as the online card activation decline 
message, but preferably, the already activated message will notify the cardholder that the 
card cannot be activated online for any predetermined reason, including, for example, 
"Your card has already been activated " (step 21). 

If the card has not already been activated, the second computing means next 
processes the card information through the fraud processing rules (step 23). 

As seen by the functional blocks in Fig. 3, the fraud processing rules provide a high 
level process which allows the card provider to more accurately determine whether the card 
being activated belongs to the cardholder. The fraud rule processing may include any of 
several types of fraud processing known in the art which identifies that a particular 
activation attempt is fraudulent. As known to those of skill in the art, the fraud rule 
processing step is configured to minimize potential loss due to fraudulent card activations 
or attempts. 

Referring again to Fig. 3, when the fraud processing rules are executed, the second 
computing system 201 uses the predetermined card information to obtain the card 
information and apply such information to the fraud rule processing as discussed by 
example above (steps 25, 27). Thus, for example, the exemplary fraud step gathers 
cardholder data from the card issuance, authorization, and billing systems and databases 
stored on either the second or third computing systems 201, 301, and applies such data to 
the established fraud processing rules (steps 25, 27). If any information provided by the 
cardholder does not correspond to the provider's system data or otherwise does not 
comport with the fraud rule processing described previously (step 25) so that the 
information does not pass the fraud rules (step 27), an online card activation decline 
message is displayed to the cardholder on first computing system 101 via network Ni. 
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[0028] If the information provided does correspond to the provider's system data, the 

process next allows the second computing system to analyze system data to initially 
determine whether the required authentication data is available (steps 29, 31). If 
authentication data is not available on the second computing system 201 (step 31), the 
second computing system 201 then transmits an online card activation decline message to 
the cardholder for display on first computing system 101 via network Ni. The online card 
activation decline message may be of any suitable text, but in one embodiment, will notify 
the cardholder that the card cannot be activated online for any predetermined reason, 
including, for example, "We cannot process your request at this time. Please call our 1-800 
number for further assistance." 

[0029] Referring to Fig. 3 a, if the required authentication data is available, but in one 

embodiment, prior to authenticating, the process next determines whether the card 

^ information corresponds to a card which is already registered in an existing provider service 

w (step 33). Optimally, the existing provider service information can reside on either the 

ffl 

4* second or third computing systems (201, 301), but those of skill in the art will realize that 

jjj other computing systems coupled to a network N x can be used. 

[tf|30] If the card is not already registered with an existing provider service, the second 

p computing system 201 prompts the cardholder via first computing system 101 for 

^ cardholder authentication information as described above and also offers the cardholder an 

S| option to enroll in other provider services (step 35). Thereafter, the process proceeds to 

2 step 43 as illustrated in Fig. 3 . 

[0031] If the card is already registered with an existing provider service (step 33) (such as 

"Manage Your Card Account™" located at www.americanexpress.com), the second 
computing system 201 then prompts the cardholder via first computing system 101 for the 
cardholder to enter existing service data corresponding to the existing service registration 
(step 37). The existing service data entered by the cardholder may include a unique user ID 
and password corresponding to the service. The existing service data is transmitted to the 
second computing system 201, wherein the second computing system validates the existing 
service data against service data stored in second computing system 201 (step 39). Similar 
to step 35 described above, the cardholder is then prompted for cardholder authentication 
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information to authenticate that the cardholder is the person who is supposed to correspond 
to the card already enrolled in an existing provider service (step 41). 
[0032] Thus, for example, if the cardholder is presently enrolled in "Manage Your Card 

Account™" (a service offered by American Express® at www.americanexpress.com), the 
cardholder to verifies their identity using their corresponding single sign on (SSO) user ED 
and password. Thereafter, the SSO Logon page is displayed on the first computing system 
10 1. After the user enters their corresponding ID and password, the SSO system validates 
the entry step 41). Subsequently, the second computing system 201 prompts the cardholder 
via first computing system 101 for cardholder authentication information (step 41). 
Thereafter, the process proceeds to step 43 as illustrated in Fig. 3. 
[0033] The authentication processes described in steps 35 and 41 first determines whether 

authentication data is available on either second or third computing systems (201, 301), and 
if so, authenticates that the cardholder is the person who is supposed to correspond to the 
^1 card (step 43). During this authentication process, for example, authentication is determined 

*j* by allowing the second computing system 201 to generate questions to the user on the first 

^ computing system 101 to verify that the cardholder should be the proper party to possess 

ill the card. Thus, for example, the second computing system 201 may ask for the 

h\. cardholder's date of birth, social security information or like personal information or like 
identifiers which are already stored in either second or third computing systems (201, 301). 
si A predetermined number of questions or identifiers, and preferably two identifiers, will be 

H selected by the second computing system 201 and displayed to the cardholder on first 
computing system 101. Those of skill in the art will realize that this selection process can 
either be implemented in one embodiment as a static selection (e.g., the same identifiers can 
be used repeatedly) or a dynamic selection (e.g., the second computing system 201 may 
randomly or specifically select appropriate identifiers). Once answers to the identifiers (or 
questions posed) are received by the second computing system 201, the second computing 
system can then process and authenticate the identifiers by comparing such identifiers to the 
cardholder's account. If the required authentication data is not available (step 31) on the 
second computing system (e.g., due to a lack of information such as social security number, 
date of birth, etc.), the second computing system 201 then transmits an online card 
activation decline message to the cardholder for display on first computing system 101 via 
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network Ni. The online card activation decline message may be of any suitable text, but in 
one embodiment, will notify the cardholder that the card cannot be activated online for any 
predetermined reason, including, for example, "We cannot process your request at this time. 
Please call our 1-800 number for further assistance " The authentication step is useful in 
those situations where the card was accidentally mailed to the wrong address, and thus, the 
wrong cardholder. This step is also useful to minimize fraud risk associated with the online 
activation by deterring a person from stealing the inactivated card and later, attempting to 
activate the card online in accordance with the present invention. If any identifier provided 
is not valid, an online card activation decline message is displayed to the cardholder on first 
computing system 101 via network Ni. 
[0034] In one embodiment, during the authentication process (steps 35, 410, a 

predetermined number of questions relating to the cardholder's personal information or like 

O 

ip identifiers (and preferably at least two identifiers) will be selected from a pool of available 

items based on what data is available on the authorization and billing systems and 
5; databases. If one or more identifiers with data available does not exist or cannot be 

ry processed, an online card activation decline message is displayed to the cardholder on first 

computing system 101 via network Ni. If data for at least two identifiers is found, a page is 
O presented on the site requesting such identifier data from the cardholder. The data entered 

q by the cardholder is then compared to the system's data to authenticate the user attempting 

^ to activate the card is the cardholder. 

[0035] If the entered data for authentication does not match the system data, an online card 

activation decline message similar to that described above is displayed to the cardholder on 
first computing system 101 via network Ni (step 43). Alternatively, if the data matches 
(step 43), the process will continue with the activation or approval process (step 45). 
During the approval process, the second computing system 201 approves the card for use 
by the cardholder, updates its database and corresponding databases and notifies the 
cardholder of the card approval on the first computing system 101. Optionally, the second 
computing system 201 may notify the cardholder of approval by communicating the 
approval to the cardholder's electronic mail address. 

[0036] The process next determines whether the cardholder requested enrollment in an 

existing provider service (steps 35, 47). If so, the enrollment request is processed (step 49) 
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and a subsequent online "Thank you " message or like activation confirmation notification 
message will be generated by the second computing system 201 and transmitted to the first 
computing system 101. If the cardholder did not request enrollment in an existing provider 
service, the online "Thank you." message or like activation confirmation notification 
message will be generated by the second computing system 201 and transmitted to the first 
computing system 101. Thus, it can readily be seen that if all the identification and 
authentication steps have been successfully passed, the card is activated for use in the 
authorization system. The "Thank you" message step may be customized based on the 
tenure, product and enrollment options of the cardholder. Additionally, if during the 
activation process, the user/cardholder indicated they would like to enroll in one of the 
provider's services such as "Manage Your Card Account™" (an option offered, for 
example, on the first authentication page), the card may suitably be automatically and 
systematically registered in the existing provider service such as the Manage Your Card 
Account™. This registration will then be confirmed on the "thank you" page or like page 
displayed on the site when applicable. 

Referring now to Fig. 4, when an error is detected as described in any of the 
foregoing processes, the second computing system 201 presents, on the first computing 
system 101, the cardholder with the option of, for example, either telephonically calling a 
voice recognition response system or contacting the provider's representative through on- 
line, real time interactive communication (step 51). If the cardholder decides to call, a 
telephone number (such as for example a 1-800 number) is displayed on the first computing 
system 101 from the site on the second computing system 201. If the cardholder decides to 
engage in an interactive communication dialog with the provider, the second computing 
system 201 displays a dialog window to the cardholder on the web site (via first computing 
system 101) and attempts to make a similar communication connection with a provider 
representative (step 53). The second computing system 201 then functions as a 
communication intermediary to allow real-time interactive communication between the 
cardholder and the provider's on-line representative to authenticate and/or validate the 
issued card or otherwise communicate with the cardholder in real time (step 55). 

As will be fully appreciated by those of skill in the art, in an exemplary 
embodiment, the present invention is configured to deliver the following exemplary system 
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functions: create a new online network site for any consumer or cardholder that upon 
successful completion of the present invention, the ability for the cardholder to either 
activate the card; provide the ability for the cardholder to access the site directly or through 
linkages or hyperlinkages from other host sites; develop an infrastructure that is 
flexible/expandable to support future growth and changing business needs (e.g., the present 
invention is intended to support both existing and future card products, and existing and 
future fraud prevention rules, etc.); perform validation/authentication checks on cardholder 
supplied data by the use of one or more data sources; offer enrollment to cardholders on 
cards not already registered in Manage Your Card Account™ (which is described in more 
detail at www.americanexpress.com); provide data tracking capabilities to produce reports 
that monitor site traffic performance, business goals and potential fraud activities; provide 
the cardholder access to the provider's customer service via online chat; and also provide 
electronic mail confirmation capability. 

The present invention provides several advantages for both the card provider as well 
as the cardholder. For example, the provider may gain a significant financial benefit by 
decreasing the costs associated with traditional card activation methodologies through 
either the voice response or customer service (either the TSC or CFS channel). Further, the 
provider is given the opportunity to cross-sell additional products and/or services while 
communicating promotional offers through various links within the host (i.e., American 
Express) web site. In similar fashion, the cardholder is provided with positive satisfaction 
by the present invention, which allows a convenient, and possibly preferred, channel for 
cardholders to activate their card. Further, use of an online activation mechanism increases 
cardholder satisfaction and reduces the demand for card activations currently being 
processed manually by a customer service representative or through the voice response 
system. It is expected that the present invention will be used by a certain percentage of all 
cardholders for activating their cards, producing a reduction of between $2 and $3 per card 
activation. The cost reduction for activating is based upon, for example, the cost reduction 
for activating cards online over the current channels, the incremental revenue produced by 
customers that act on the cross-sell offers that are presented to them during the online 
activation process, and the increased customer satisfaction over a process that is more 
convenient, accessible, simple, and seamless in its use. 
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As such, the present invention addresses a need for managing risk and fraud for 
newly issued plastic. The present invention is able to integrate fraud detection as three 
discrete layers or processes to assure the identity of the user, while providing a convenient, 
low cost, online method for customers to activate their cards. The present invention also 
optimizes and maximizes the interaction with the customer to extend the provider's 
relationship and opportunity with the customer cardholder. The ability to integrate cross- 
sell opportunities while the customer is activating their card is likely to increase enrollment 
in the services that are being exposed to the customer. 

An exemplary embodiment of the present invention includes the integration of the 
fraud detection capabilities into an online platform that provides an acceptable level of risk. 
The fraud detection capabilities are comparable to those offered in typical card activation 
systems. There will always be instances where the online system cannot complete the 
activation. Some of these are operational in nature, but many are rule based as defined in 
the fraud detection function. Instead of redirecting the user to call a phone number as most 
prior art systems would require, the present invention enables an immediate and interactive 
online chat with a customer service representative that is convenient, simple and seamless 
for the user and their online experience. 

The present invention provides a completely integrated solution for the cardholder 
user. Using the new online site, all or a predetermined number of the requisite rules and 
verifications are applied to each user request. The goal is that a card can be activated 
without any external intervention, but if required, the present invention will establish an 
immediate and integrated online chat session with a provider's customer service 
representative. This process or method produces an experience that is complete (no 
redirecting of inquiries), effortless and seamless. 

Moreover, the present invention looks to integrate the card activation process into 
the larger customer interaction with the issuer, by providing links to other areas of interest 
within the web-site. This includes an integrated cross-sell capability that reacts to the 
relationship that exists with the customer (the issuer can minimize providing offers for 
products and services previously obtained by the cardmember). 

The present invention may be described herein in terms of functional block 
components, screen shots, optional selections and various processing steps. It should be 



14 



EL608986912US 



appreciated that such functional blocks may be realized by any number of hardware and/or 
software components configured to perform the specified functions. For example, the 
present invention may employ various integrated circuit components, e.g., memory 
elements, processing elements, logic elements, look-up tables, and the like, which may 
carry out a variety of functions under the control of one or more microprocessors or other 
control devices. Similarly, the software elements of the present invention may be 
implemented with any programming or scripting language such as C, C++, Java, XML, 
COBOL, assembler, PERL, or the like, with the various algorithms being implemented with 
any combination of data structures, objects, processes, routines or other programming 
elements. Further, it should be noted that the present invention may employ any number of 
conventional techniques for data transmission, signaling, data processing, network control, 
and the like. For a basic introduction of cryptography, please review a text written by Bruce 
Schneier which is entitled "Applied Cryptography: Protocols, Algorithms, And Source 

m Code In C," published by John Wiley & Sons (second edition, 1996), which is hereby 

.|: incorporated by reference as background. 

[|$45] It should be appreciated that the particular implementations shown and described 

if! herein are illustrative of the invention and its best mode, and are not intended to otherwise 

f I limit the scope of the present invention in any way. Indeed, for the sake of brevity, 

& conventional data networking, application development and other functional aspects of the 

SI systems (and components of the individual operating components of the systems) may not 

rr be described in detail herein. Furthermore, the connecting lines shown in the various 

figures contained herein are intended to represent exemplary functional relationships and/or 
physical couplings between the various elements. It should be noted that many alternative 
or additional functional relationships or physical connections may be present in a practical 
electronic transaction system. 
[0046] It will be appreciated, that many applications of the present invention could be 

formulated. One skilled in the art will appreciate that the network may include any system 
for exchanging data or transacting business, such as the Internet, an intranet, an extranet, 
WAN, LAN, satellite communications, and/or the like. The users may interact with the 
system via any input device such as a keyboard, mouse, kiosk, personal digital assistant, 
handheld computer (e.g., Palm Pilot®), cellular phone and/or the like. Similarly, the 
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invention could be used in conjunction with any type of personal computer, network 
computer, workstation, minicomputer, mainframe, or the like running any operating system 
such as any version of Windows, Windows NT, Windows2000, Windows 98, Windows 95, 
MacOS, OS/2, BeOS, Linux, UNIX, or the like. Moreover, although the invention is 
frequently described herein as being implemented with TCP/IP communications protocols, 
it will be readily understood that the invention could also be implemented using IPX, 
Appletalk, EP-6, NetBIOS, OSI or any number of existing or future protocols. Moreover, 
the system contemplates the use, sale or distribution of any goods, services or information 
over any network having similar functionality described herein. 

The computing units may be connected with each other via a data communication 
network. The network may be a public network and assumed to be insecure and open to 
eavesdroppers. In the illustrated implementation, the network may be embodied as the 
internet. In this context, the computers may or may not be connected to the internet at all 
times. For instance, the customer computer may employ a modem to occasionally connect 
to the internet, whereas the bank computing center might maintain a permanent connection 
to the internet. Specific information related to the protocols, standards, and application 
software utilized in connection with the Internet may not be discussed herein. For further 
information regarding such details, see, for example, Dilip NAIK, INTERNET STANDARDS 
and Protocols (1998); Java2 Complete, various authors, (Sybex 1999); Deborah Ray 

AND ERIC RAY, MASTERING HTML 4.0 (1997). LOSHIN, TCP/IP CLEARLY EXPLAINED 
(1997). All of these texts are hereby incorporated by reference as background. 

Without limitation, cardholders, issuers and merchants systems and servers are 
suitably coupled to a network via data links. A variety of conventional communications 
media and protocols may be used for data links, such as, for example, a connection to an 
Internet Service Provider (ISP) over the local loop as is typically used in connection with 
standard modem communication, cable modem, dish networks, ISDN, Digital Subscriber 
Line (DSL), or various wireless communication methods. A representative merchant 
system might also reside within a local area network (LAN) which interfaces to a network 
via a leased line (Tl, D3, etc.). Such communication methods are well known in the art, 
and are covered in a variety of standard texts. See, e.g., Gilbert Held, Understanding 
Data Communications (1996), hereby incorporated by reference as background. 
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As will be appreciated by one of ordinary skill in the art, the present invention may 
be embodied as a method, a data processing system, a device for data processing, and/or a 
computer program product. Accordingly, the present invention may take the form of an 
entirely software embodiment, an entirely hardware embodiment, or an embodiment 
combining aspects of both software and hardware. Furthermore, the present invention may 
take the form of a computer program product on a computer-readable storage medium 
having computer-readable program code means embodied in the storage medium. Any 
suitable computer-readable storage medium may be utilized, including hard disks, CD- 
ROM, optical storage devices, magnetic storage devices, and/or the like. 

Communication between the parties to the transaction and the system of the present 
invention is accomplished through any suitable communication means, such as, for 
example, a telephone network, Intranet, Internet, point of interaction device (point of sale 
device, personal digital assistant, cellular phone, kiosk, etc.), online communications, off- 
line communications, wireless communications, and/or the like. One skilled in the art will 
also appreciate that, for security reasons, any databases, systems, or components of the 
present invention may consist of any combination of databases or components at a single 
location or at multiple locations, wherein each database or system includes any of various 
suitable security features, such as firewalls, access codes, encryption, de-encryption, 
compression, decompression, and/or the like. 

The present invention is described herein with reference to block diagrams and 
flowchart illustrations of methods, apparatus (e.g., systems), and computer program 
products according to various aspects of the invention. It will be understood that each 
functional block of the block diagrams and the flowchart illustrations, and combinations of 
functional blocks in the block diagrams and flowchart illustrations, respectively, can be 
implemented by computer program instructions. These computer program instructions may 
be loaded onto a general purpose computer, special purpose computer, or other 
programmable data processing apparatus to produce a machine, such that the instructions 
which execute on the computer or other programmable data processing apparatus create 
means for implementing the functions specified in the flowchart block or blocks. 

These computer program instructions may also be stored in a computer-readable 
memory that can direct a computer or other programmable data processing apparatus to 
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function in a particular manner, such that the instructions stored in the computer-readable 
memory produce an article of manufacture including instruction means which implement 
the function specified in the flowchart block or blocks. The computer program instructions 
may also be loaded onto a computer or other programmable data processing apparatus to 
cause a series of operational steps to be performed on the computer or other programmable 
apparatus to produce a computer-implemented process such that the instructions which 
execute on the computer or other programmable apparatus provide steps for implementing 
the functions specified in the flowchart block or blocks. 

Accordingly, functional blocks of the block diagrams and flowchart illustrations 
support combinations of means for performing the specified functions, combinations of 
steps for performing the specified functions, and program instruction means for performing 
the specified functions. It will also be understood that each functional block of the block 
diagrams and flowchart illustrations, and combinations of functional blocks in the block 
diagrams and flowchart illustrations, can be implemented by either special purpose 
hardware-based computer systems which perform the specified functions or steps, or 
suitable combinations of special purpose hardware and computer instructions. 

The customer and merchant may represent individual people, entities, or business. 
Although discussed as a card issuer, the card issuer may represent other types of banks or 
card issuing institutions, such as credit card companies, card sponsoring companies, or third 
party issuers under contract with financial institutions. It is further noted that other 
participants may be involved in some phases of the transaction, such as an intermediary 
settlement institution, but these participants are not shown. 

The computing units are connected with each other via a data communication 
network. The network may be a public network and assumed to be insecure and open to 
eavesdroppers. In the illustrated implementation, the network is embodied as the Internet. 
In this context, the computers may or may not be connected to the Internet at all times. For 
instance, the customer computer may employ a modem to occasionally connect to the 
Internet, whereas the bank computing center might maintain a permanent connection to the 
Internet. It is noted that the network may be implemented as other types of networks, such 
as an interactive television (ITV) network. 
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The third computing system 301 and the second computing system 201 are in one 
embodiment interconnected via a second network, referred to, for example, as a payment 
network. The payment network represents existing proprietary networks that presently 
accommodate transactions for credit cards, debit cards, and other types of financial/banking 
cards. The payment network is a closed network that is assumed to be secure from 
eavesdroppers. Examples of representative payment networks include the American 
Express®, VisaNet® and the Veriphone® network. 

The electronic commerce system is implemented at the customer and issuing bank. 
In an exemplary implementation, the electronic commerce system is implemented as 
computer software modules loaded onto the customer computer and the banking computing 
center. The third computing system may not require any additional software to participate 
in the online commerce transactions supported by the online commerce system. 

In the foregoing specification, the invention has been described with reference to 
specific embodiments. However, it will be appreciated that various modifications and 
changes can be made without departing from the scope of the present invention as set forth 
in the claims below. The specification and figures are to be regarded in an illustrative 
manner, rather than a restrictive one, and all such modifications are intended to be included 
within the scope of present invention. Accordingly, the scope of the invention should be 
determined by the appended claims and their legal equivalents, rather than by the examples 
given above. For example, the steps recited in any of the method or process claims may be 
executed in any order and are not limited to the order presented in the claims. 

Benefits, other advantages, and solutions to problems have been described above 
with regard to specific embodiments. However, the benefits, advantages, solutions to 
problems, and any elements) that may cause any benefit, advantage, or solution to occur or 
become more pronounced are not to be construed as critical, required, or essential features 
or elements of any or all the claims. As used herein, the terms "comprises", "comprising", 
or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a 
process, method, article, or apparatus that comprises a list of elements does not include only 
those elements but may include other elements not expressly listed or inherent to such 
process, method, article, or apparatus. Further, no element described herein is required for 
the practice of the invention unless expressly described as "essential" or " critical". 
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